@burdenoff/be-sdk 2026.704.1 → 2026.705.2

package/dist/{chunk-GTEMQXCA.js → chunk-QLXIIF4I.js}

@@ -34,7 +34,8 @@ var defaultConfig = {
   excludeModelsFromReadIsolation: [],
   strictMode: true,
   allowedUnguardedOperations: [],
-  debug: false
+  debug: false,
+  enableApplicationNameTagging: false
 };
 function hasField(data, field) {
   return field in data;
@@ -138,6 +139,20 @@ function enforceStrictMode(model, operation, wsCtx, config) {
   throw new Error(`[WorkspaceExtension] Workspace context required for ${model}.${operation}. No workspaceId found in request context. To bypass, either: (1) add "${model}" to excludeModels, (2) add "${opKey}" to allowedUnguardedOperations, or (3) pass _skipWorkspaceInjection: true in the query args.`);
 }
 __name(enforceStrictMode, "enforceStrictMode");
+var taggedContexts = /* @__PURE__ */ new WeakSet();
+async function maybeTagConnection(rawPrisma, wsCtx) {
+  if (taggedContexts.has(wsCtx)) return;
+  taggedContexts.add(wsCtx);
+  const safeSvc = (process.env["SERVICE_NAME"] ?? "svc").replace(/[^a-zA-Z0-9\-_]/g, "");
+  const safeWs = (wsCtx.workspaceId ?? "").replace(/[^a-zA-Z0-9\-_]/g, "");
+  const tag = `svc=${safeSvc};ws=${safeWs}`;
+  try {
+    await rawPrisma.$executeRawUnsafe(`SET application_name = '${tag}'`);
+  } catch {
+    taggedContexts.delete(wsCtx);
+  }
+}
+__name(maybeTagConnection, "maybeTagConnection");
 function addWorkspaceExtension(baseClient, config) {
   const fullConfig = {
     ...defaultConfig,
@@ -147,6 +162,7 @@ function addWorkspaceExtension(baseClient, config) {
     logger.info("[WorkspaceExtension] Extension disabled by configuration");
     return baseClient;
   }
+  const rawPrisma = baseClient;
   const prismaClient = baseClient;
   logger.info("[WorkspaceExtension] Workspace extension enabled", {
     populateContextJson: fullConfig.populateContextJson,
@@ -159,7 +175,8 @@ function addWorkspaceExtension(baseClient, config) {
     strictMode: fullConfig.strictMode,
     excludeModels: fullConfig.excludeModels,
     excludeModelsFromReadIsolation: fullConfig.excludeModelsFromReadIsolation,
-    allowedUnguardedOperations: fullConfig.allowedUnguardedOperations
+    allowedUnguardedOperations: fullConfig.allowedUnguardedOperations,
+    enableApplicationNameTagging: fullConfig.enableApplicationNameTagging
   });
   return prismaClient.$extends({
     query: {
@@ -176,6 +193,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (!wsCtx?.workspaceId) {
             return query(args);
           }
+          if (fullConfig.enableApplicationNameTagging) {
+            await maybeTagConnection(rawPrisma, wsCtx);
+          }
           const injectedData = injectCreateFields(args.data, wsCtx, fullConfig);
           if (fullConfig.debug) {
             const injectedKeys = Object.keys(injectedData).filter((k) => !(k in args.data));
@@ -200,6 +220,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (!wsCtx?.workspaceId) {
             return query(args);
           }
+          if (fullConfig.enableApplicationNameTagging) {
+            await maybeTagConnection(rawPrisma, wsCtx);
+          }
           const dataArray = Array.isArray(args.data) ? args.data : [
             args.data
           ];
@@ -218,6 +241,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (!wsCtx?.workspaceId) {
             return query(args);
           }
+          if (fullConfig.enableApplicationNameTagging) {
+            await maybeTagConnection(rawPrisma, wsCtx);
+          }
           const dataArray = Array.isArray(args.data) ? args.data : [
             args.data
           ];
@@ -239,6 +265,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (!wsCtx?.workspaceId) {
             return query(args);
           }
+          if (fullConfig.enableApplicationNameTagging) {
+            await maybeTagConnection(rawPrisma, wsCtx);
+          }
           const injectedData = injectUpdateFields(args.data, wsCtx, fullConfig);
           let injectedWhere = args.where;
           if (fullConfig.enableUpdateWhereIsolation && !isExcludedFromReadIsolation(model, fullConfig)) {
@@ -266,6 +295,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (!wsCtx?.workspaceId) {
             return query(args);
           }
+          if (fullConfig.enableApplicationNameTagging) {
+            await maybeTagConnection(rawPrisma, wsCtx);
+          }
           const injectedData = injectUpdateFields(args.data, wsCtx, fullConfig);
           let injectedWhere = args.where;
           if (fullConfig.enableUpdateWhereIsolation && !isExcludedFromReadIsolation(model, fullConfig)) {
@@ -286,6 +318,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (!wsCtx?.workspaceId) {
             return query(args);
           }
+          if (fullConfig.enableApplicationNameTagging) {
+            await maybeTagConnection(rawPrisma, wsCtx);
+          }
           const injectedCreate = injectCreateFields(args.create, wsCtx, fullConfig);
           const injectedUpdate = injectUpdateFields(args.update, wsCtx, fullConfig);
           let injectedWhere = args.where;
@@ -311,6 +346,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (!wsCtx?.workspaceId) {
             return query(args);
           }
+          if (fullConfig.enableApplicationNameTagging) {
+            await maybeTagConnection(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.findMany - injected workspaceId into where`, {
@@ -331,6 +369,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (!wsCtx?.workspaceId) {
             return query(args);
           }
+          if (fullConfig.enableApplicationNameTagging) {
+            await maybeTagConnection(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.findFirst - injected workspaceId into where`, {
@@ -351,6 +392,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (!wsCtx?.workspaceId) {
             return query(args);
           }
+          if (fullConfig.enableApplicationNameTagging) {
+            await maybeTagConnection(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.findFirstOrThrow - injected workspaceId into where`, {
@@ -371,6 +415,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (!wsCtx?.workspaceId) {
             return query(args);
           }
+          if (fullConfig.enableApplicationNameTagging) {
+            await maybeTagConnection(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.findUnique - injected workspaceId into where`, {
@@ -391,6 +438,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (!wsCtx?.workspaceId) {
             return query(args);
           }
+          if (fullConfig.enableApplicationNameTagging) {
+            await maybeTagConnection(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.findUniqueOrThrow - injected workspaceId into where`, {
@@ -411,6 +461,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (!wsCtx?.workspaceId) {
             return query(args);
           }
+          if (fullConfig.enableApplicationNameTagging) {
+            await maybeTagConnection(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.count - injected workspaceId into where`, {
@@ -431,6 +484,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (!wsCtx?.workspaceId) {
             return query(args);
           }
+          if (fullConfig.enableApplicationNameTagging) {
+            await maybeTagConnection(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.aggregate - injected workspaceId into where`, {
@@ -451,6 +507,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (!wsCtx?.workspaceId) {
             return query(args);
           }
+          if (fullConfig.enableApplicationNameTagging) {
+            await maybeTagConnection(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.groupBy - injected workspaceId into where`, {
@@ -474,6 +533,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (!wsCtx?.workspaceId) {
             return query(args);
           }
+          if (fullConfig.enableApplicationNameTagging) {
+            await maybeTagConnection(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.delete - injected workspaceId into where`, {
@@ -494,6 +556,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (!wsCtx?.workspaceId) {
             return query(args);
           }
+          if (fullConfig.enableApplicationNameTagging) {
+            await maybeTagConnection(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.deleteMany - injected workspaceId into where`, {
@@ -511,6 +576,6 @@ function addWorkspaceExtension(baseClient, config) {
 }
 __name(addWorkspaceExtension, "addWorkspaceExtension");
 
-export { addWorkspaceExtension, getWorkspaceContext, injectWhereWorkspaceId, setWorkspaceContext, withWorkspaceContext, withWorkspaceContextSync };
-//# sourceMappingURL=chunk-GTEMQXCA.js.map
-//# sourceMappingURL=chunk-GTEMQXCA.js.map
+export { addWorkspaceExtension, getWorkspaceContext, injectWhereWorkspaceId, maybeTagConnection, setWorkspaceContext, withWorkspaceContext, withWorkspaceContextSync };
+//# sourceMappingURL=chunk-QLXIIF4I.js.map
+//# sourceMappingURL=chunk-QLXIIF4I.js.map

package/dist/chunk-QLXIIF4I.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/prisma/workspace-extension.ts"],"names":["workspaceContextStore","AsyncLocalStorage","fallbackContext","setWorkspaceContext","context","enterWith","getWorkspaceContext","getStore","withWorkspaceContext","fn","run","withWorkspaceContextSync","defaultConfig","enabled","enableReadIsolation","enableDeleteIsolation","enableUpdateWhereIsolation","populateContextJson","populateCreatedBy","populateUpdatedBy","populateTenantId","excludeModels","excludeModelsFromReadIsolation","strictMode","allowedUnguardedOperations","debug","enableApplicationNameTagging","hasField","data","field","injectCreateFields","wsCtx","config","injected","workspaceId","tenantId","actorId","onBehalfOf","contextJson","buildContextJsonFromWorkspaceContext","injectUpdateFields","injectWhereClause","where","organizationId","projectId","appId","Object","keys","length","undefined","injectWhereWorkspaceId","ctx","stripSkipFlag","args","cleaned","isExcludedFromReadIsolation","model","includes","enforceStrictMode","operation","opKey","Error","taggedContexts","WeakSet","maybeTagConnection","rawPrisma","has","add","safeSvc","process","env","replace","safeWs","tag","$executeRawUnsafe","delete","addWorkspaceExtension","baseClient","fullConfig","logger","info","prismaClient","$extends","query","$allModels","create","_skipWorkspaceInjection","injectedData","injectedKeys","filter","k","join","createMany","dataArray","Array","isArray","map","item","createManyAndReturn","update","injectedWhere","injectedDataKeys","whereChanged","updateMany","upsert","injectedCreate","injectedUpdate","findMany","findFirst","findFirstOrThrow","findUnique","findUniqueOrThrow","count","aggregate","groupBy","deleteMany"],"mappings":";;;;AA6EA,IAAMA,qBAAAA,GAAwB,IAAIC,iBAAAA,EAAAA;AAUlC,IAAIC,eAAAA;AA6BG,SAASC,oBAAoBC,OAAAA,EAAyB;AAC3DJ,EAAAA,qBAAAA,CAAsBK,UAAUD,OAAAA,CAAAA;AAChCF,EAAAA,eAAAA,GAAkBE,OAAAA;AACpB;AAHgBD,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAaT,SAASG,mBAAAA,GAAAA;AACd,EAAA,OAAON,qBAAAA,CAAsBO,UAAQ,IAAML,eAAAA;AAC7C;AAFgBI,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAuBhB,eAAsBE,oBAAAA,CAAwBJ,SAA2BK,EAAAA,EAAoB;AAC3F,EAAA,OAAOT,qBAAAA,CAAsBU,GAAAA,CAAIN,OAAAA,EAASK,EAAAA,CAAAA;AAC5C;AAFsBD,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAOf,SAASG,wBAAAA,CAA4BP,SAA2BK,EAAAA,EAAW;AAChF,EAAA,OAAOT,qBAAAA,CAAsBU,GAAAA,CAAIN,OAAAA,EAASK,EAAAA,CAAAA;AAC5C;AAFgBE,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA;AAwJhB,IAAMC,aAAAA,GAAoD;EACxDC,OAAAA,EAAS,IAAA;EACTC,mBAAAA,EAAqB,IAAA;EACrBC,qBAAAA,EAAuB,IAAA;EACvBC,0BAAAA,EAA4B,IAAA;EAC5BC,mBAAAA,EAAqB,IAAA;EACrBC,iBAAAA,EAAmB,IAAA;EACnBC,iBAAAA,EAAmB,IAAA;EACnBC,gBAAAA,EAAkB,KAAA;AAClBC,EAAAA,aAAAA,EAAe,EAAA;AACfC,EAAAA,8BAAAA,EAAgC,EAAA;EAChCC,UAAAA,EAAY,IAAA;AACZC,EAAAA,0BAAAA,EAA4B,EAAA;EAC5BC,KAAAA,EAAO,KAAA;EACPC,4BAAAA,EAA8B;AAChC,CAAA;AASA,SAASC,QAAAA,CAASC,MAA+BC,KAAAA,EAAa;AAC5D,EAAA,OAAOA,KAAAA,IAASD,IAAAA;AAClB;AAFSD,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAOT,SAASG,kBAAAA,CACPF,IAAAA,EACAG,KAAAA,EACAC,MAAAA,EAA0C;AAE1C,EAAA,MAAMC,QAAAA,GAAW;IAAE,GAAGL;AAAK,GAAA;AAG3B,EAAA,IAAIG,MAAMG,WAAAA,IAAe,CAACP,QAAAA,CAASM,QAAAA,EAAU,aAAA,CAAA,EAAgB;AAC3DA,IAAAA,QAAAA,CAAS,aAAA,IAAiBF,KAAAA,CAAMG,WAAAA;AAClC,EAAA;AAGA,EAAA,IAAIF,MAAAA,CAAOZ,oBAAoBW,KAAAA,CAAMI,QAAAA,IAAY,CAACR,QAAAA,CAASM,QAAAA,EAAU,UAAA,CAAA,EAAa;AAChFA,IAAAA,QAAAA,CAAS,UAAA,IAAcF,KAAAA,CAAMI,QAAAA;AAC/B,EAAA;AAGA,EAAA,IAAIH,MAAAA,CAAOd,qBAAqBa,KAAAA,CAAMK,OAAAA,IAAW,CAACT,QAAAA,CAASM,QAAAA,EAAU,WAAA,CAAA,EAAc;AACjFA,IAAAA,QAAAA,CAAS,WAAA,IAAeF,KAAAA,CAAMK,OAAAA;AAChC,EAAA;AAGA,EAAA,IAAIJ,MAAAA,CAAOb,qBAAqBY,KAAAA,CAAMK,OAAAA,IAAW,CAACT,QAAAA,CAASM,QAAAA,EAAU,WAAA,CAAA,EAAc;AACjFA,IAAAA,QAAAA,CAAS,WAAA,IAAeF,KAAAA,CAAMK,OAAAA;AAChC,EAAA;AAIA,EAAA,IAAIL,MAAMM,UAAAA,IAAc,CAACV,QAAAA,CAASM,QAAAA,EAAU,YAAA,CAAA,EAAe;AACzDA,IAAAA,QAAAA,CAAS,YAAA,IAAgBF,KAAAA,CAAMM,UAAAA;AACjC,EAAA,CAAA,MAAA,IAAWN,MAAMK,OAAAA,IAAW,CAACT,QAAAA,CAASM,QAAAA,EAAU,YAAA,CAAA,EAAe;AAE7DA,IAAAA,QAAAA,CAAS,YAAA,IAAgBF,KAAAA,CAAMK,OAAAA;AACjC,EAAA;AAGA,EAAA,IAAIJ,OAAOf,mBAAAA,IAAuB,CAACU,QAAAA,CAASM,QAAAA,EAAU,SAAA,CAAA,EAAY;AAChE,IAAA,MAAMK,WAAAA,GAAcC,qCAAqCR,KAAAA,CAAAA;AACzD,IAAA,IAAIO,WAAAA,EAAa;AACfL,MAAAA,QAAAA,CAAS,SAAA,CAAA,GAAaK,WAAAA;AACxB,IAAA;AACF,EAAA;AAEA,EAAA,OAAOL,QAAAA;AACT;AA7CSH,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AAkDT,SAASU,kBAAAA,CACPZ,IAAAA,EACAG,KAAAA,EACAC,MAAAA,EAA0C;AAE1C,EAAA,MAAMC,QAAAA,GAAW;IAAE,GAAGL;AAAK,GAAA;AAG3B,EAAA,IAAII,MAAAA,CAAOb,qBAAqBY,KAAAA,CAAMK,OAAAA,IAAW,CAACT,QAAAA,CAASM,QAAAA,EAAU,WAAA,CAAA,EAAc;AACjFA,IAAAA,QAAAA,CAAS,WAAA,IAAeF,KAAAA,CAAMK,OAAAA;AAChC,EAAA;AAMA,EAAA,OAAOH,QAAAA;AACT;AAjBSO,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AA0BT,SAASC,iBAAAA,CACPC,OACAX,KAAAA,EAAuB;AAEvB,EAAA,IAAI,CAACA,KAAAA,CAAMG,WAAAA,EAAa,OAAOQ,KAAAA;AAE/B,EAAA,IAAI,CAACA,KAAAA,EAAO;AAEV,IAAA,OAAO;AAAER,MAAAA,WAAAA,EAAaH,KAAAA,CAAMG;AAAY,KAAA;AAC1C,EAAA;AAGA,EAAA,IAAI,CAACP,QAAAA,CAASe,KAAAA,EAAO,aAAA,CAAA,EAAgB;AACnC,IAAA,OAAO;MAAE,GAAGA,KAAAA;AAAOR,MAAAA,WAAAA,EAAaH,KAAAA,CAAMG;AAAY,KAAA;AACpD,EAAA;AAEA,EAAA,OAAOQ,KAAAA;AACT;AAjBSD,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAsBT,SAASF,qCAAqCR,KAAAA,EAAuB;AACnE,EAAA,MAAM3B,UAAkC,EAAC;AAEzC,EAAA,IAAI2B,KAAAA,CAAMG,WAAAA,EAAa9B,OAAAA,CAAQ,aAAA,IAAiB2B,KAAAA,CAAMG,WAAAA;AACtD,EAAA,IAAIH,KAAAA,CAAMK,OAAAA,EAAShC,OAAAA,CAAQ,QAAA,IAAY2B,KAAAA,CAAMK,OAAAA;AAC7C,EAAA,IAAIL,KAAAA,CAAMY,cAAAA,EAAgBvC,OAAAA,CAAQ,gBAAA,IAAoB2B,KAAAA,CAAMY,cAAAA;AAC5D,EAAA,IAAIZ,KAAAA,CAAMa,SAAAA,EAAWxC,OAAAA,CAAQ,WAAA,IAAe2B,KAAAA,CAAMa,SAAAA;AAClD,EAAA,IAAIb,KAAAA,CAAMc,KAAAA,EAAOzC,OAAAA,CAAQ,OAAA,IAAW2B,KAAAA,CAAMc,KAAAA;AAE1C,EAAA,OAAOC,OAAOC,IAAAA,CAAK3C,OAAAA,CAAAA,CAAS4C,MAAAA,GAAS,IAAI5C,OAAAA,GAAU6C,MAAAA;AACrD;AAVSV,MAAAA,CAAAA,oCAAAA,EAAAA,sCAAAA,CAAAA;AA8BF,SAASW,sBAAAA,CACdR,OACAX,KAAAA,EAAwB;AAExB,EAAA,MAAMoB,GAAAA,GAAMpB,SAASzB,mBAAAA,EAAAA;AACrB,EAAA,IAAI,CAACoC,KAAAA,IAAS,CAACS,GAAAA,EAAKjB,aAAa,OAAOQ,KAAAA;AAGxC,EAAA,IAAI,CAACf,QAAAA,CAASe,KAAAA,EAAO,aAAA,CAAA,EAAgB;AACnC,IAAA,OAAO;MAAE,GAAGA,KAAAA;AAAOR,MAAAA,WAAAA,EAAaiB,GAAAA,CAAIjB;AAAY,KAAA;AAClD,EAAA;AAEA,EAAA,OAAOQ,KAAAA;AACT;AAbgBQ,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA;AAmBhB,SAASE,cAAiDC,IAAAA,EAAO;AAC/D,EAAA,MAAMC,OAAAA,GAAU;IAAE,GAAGD;AAAK,GAAA;AAC1B,EAAA,OAAQC,QAAoC,yBAAA,CAAA;AAC5C,EAAA,OAAOA,OAAAA;AACT;AAJSF,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAUT,SAASG,2BAAAA,CAA4BC,OAAexB,MAAAA,EAA0C;AAC5F,EAAA,OAAOA,MAAAA,CAAOX,cAAcoC,QAAAA,CAASD,KAAAA,KAAUxB,MAAAA,CAAOV,8BAAAA,CAA+BmC,SAASD,KAAAA,CAAAA;AAChG;AAFSD,MAAAA,CAAAA,2BAAAA,EAAAA,6BAAAA,CAAAA;AAeT,SAASG,iBAAAA,CACPF,KAAAA,EACAG,SAAAA,EACA5B,KAAAA,EACAC,MAAAA,EAA0C;AAG1C,EAAA,IAAID,OAAOG,WAAAA,EAAa;AAGxB,EAAA,IAAI,CAACF,OAAOT,UAAAA,EAAY;AAGxB,EAAA,MAAMqC,KAAAA,GAAQ,CAAA,EAAGJ,KAAAA,CAAAA,CAAAA,EAASG,SAAAA,CAAAA,CAAAA;AAC1B,EAAA,IAAI3B,MAAAA,CAAOR,0BAAAA,CAA2BiC,QAAAA,CAASG,KAAAA,CAAAA,EAAQ;AAGvD,EAAA,MAAM,IAAIC,KAAAA,CACR,CAAA,oDAAA,EAAuDL,KAAAA,CAAAA,CAAAA,EAASG,SAAAA,CAAAA,uEAAAA,EAElDH,KAAAA,CAAAA,6BAAAA,EACAI,KAAAA,CAAAA,6FAAAA,CAC+C,CAAA;AAEjE;AAxBSF,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAgGT,IAAMI,cAAAA,uBAAqBC,OAAAA,EAAAA;AAS3B,eAAsBC,kBAAAA,CAAmBC,WAAgClC,KAAAA,EAAuB;AAC9F,EAAA,IAAI+B,cAAAA,CAAeI,GAAAA,CAAInC,KAAAA,CAAAA,EAAQ;AAC/B+B,EAAAA,cAAAA,CAAeK,IAAIpC,KAAAA,CAAAA;AAEnB,EAAA,MAAMqC,OAAAA,GAAAA,CAAWC,QAAQC,GAAAA,CAAI,cAAA,KAAmB,KAAA,EAAOC,OAAAA,CAAQ,oBAAoB,EAAA,CAAA;AACnF,EAAA,MAAMC,UAAUzC,KAAAA,CAAMG,WAAAA,IAAe,EAAA,EAAIqC,OAAAA,CAAQ,oBAAoB,EAAA,CAAA;AACrE,EAAA,MAAME,GAAAA,GAAM,CAAA,IAAA,EAAOL,OAAAA,CAAAA,IAAAA,EAAcI,MAAAA,CAAAA,CAAAA;AACjC,EAAA,IAAI;AACF,IAAA,MAAMP,SAAAA,CAAUS,iBAAAA,CAAkB,CAAA,wBAAA,EAA2BD,GAAAA,CAAAA,CAAAA,CAAM,CAAA;EACrE,CAAA,CAAA,MAAQ;AAENX,IAAAA,cAAAA,CAAea,OAAO5C,KAAAA,CAAAA;AACxB,EAAA;AACF;AAbsBiC,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AAef,SAASY,qBAAAA,CAAyBC,YAAe7C,MAAAA,EAAiC;AACvF,EAAA,MAAM8C,UAAAA,GAAiD;IACrD,GAAGlE,aAAAA;IACH,GAAGoB;AACL,GAAA;AAEA,EAAA,IAAI,CAAC8C,WAAWjE,OAAAA,EAAS;AACvBkE,IAAAA,MAAAA,CAAOC,KAAK,0DAAA,CAAA;AACZ,IAAA,OAAOH,UAAAA;AACT,EAAA;AAGA,EAAA,MAAMZ,SAAAA,GAAYY,UAAAA;AAGlB,EAAA,MAAMI,YAAAA,GAAeJ,UAAAA;AAErBE,EAAAA,MAAAA,CAAOC,KAAK,kDAAA,EAAoD;AAC9D/D,IAAAA,mBAAAA,EAAqB6D,UAAAA,CAAW7D,mBAAAA;AAChCC,IAAAA,iBAAAA,EAAmB4D,UAAAA,CAAW5D,iBAAAA;AAC9BC,IAAAA,iBAAAA,EAAmB2D,UAAAA,CAAW3D,iBAAAA;AAC9BC,IAAAA,gBAAAA,EAAkB0D,UAAAA,CAAW1D,gBAAAA;AAC7BN,IAAAA,mBAAAA,EAAqBgE,UAAAA,CAAWhE,mBAAAA;AAChCC,IAAAA,qBAAAA,EAAuB+D,UAAAA,CAAW/D,qBAAAA;AAClCC,IAAAA,0BAAAA,EAA4B8D,UAAAA,CAAW9D,0BAAAA;AACvCO,IAAAA,UAAAA,EAAYuD,UAAAA,CAAWvD,UAAAA;AACvBF,IAAAA,aAAAA,EAAeyD,UAAAA,CAAWzD,aAAAA;AAC1BC,IAAAA,8BAAAA,EAAgCwD,UAAAA,CAAWxD,8BAAAA;AAC3CE,IAAAA,0BAAAA,EAA4BsD,UAAAA,CAAWtD,0BAAAA;AACvCE,IAAAA,4BAAAA,EAA8BoD,UAAAA,CAAWpD;GAC3C,CAAA;AAEA,EAAA,OAAOuD,aAAaC,QAAAA,CAAS;IAC3BC,KAAAA,EAAO;MACLC,UAAAA,EAAY;;;;AAKV,QAAA,MAAMC,MAAAA,CAAO,EACX7B,KAAAA,EACAH,IAAAA,EACA8B,OAAK,EAKL;AAEA,UAAA,IAAIL,WAAWzD,aAAAA,CAAcoC,QAAAA,CAASD,KAAAA,CAAAA,IAAUH,KAAKiC,uBAAAA,EAAyB;AAC5E,YAAA,OAAOH,KAAAA,CAAM/B,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQzB,mBAAAA,EAAAA;AACdoD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,QAAA,EAAUzB,KAAAA,EAAO+C,UAAAA,CAAAA;AAC1C,UAAA,IAAI,CAAC/C,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOiD,MAAM9B,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAIyB,WAAWpD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMsC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AAGA,UAAA,MAAMwD,YAAAA,GAAezD,kBAAAA,CAAmBuB,IAAAA,CAAKzB,IAAAA,EAAMG,OAAO+C,UAAAA,CAAAA;AAE1D,UAAA,IAAIA,WAAWrD,KAAAA,EAAO;AACpB,YAAA,MAAM+D,YAAAA,GAAe1C,MAAAA,CAAOC,IAAAA,CAAKwC,YAAAA,CAAAA,CAAcE,MAAAA,CAAO,CAACC,CAAAA,KAAM,EAAEA,CAAAA,IAAKrC,IAAAA,CAAKzB,IAAAA,CAAG,CAAA;AAC5E,YAAA,IAAI4D,YAAAA,CAAaxC,SAAS,CAAA,EAAG;AAC3B+B,cAAAA,MAAAA,CAAOtD,KAAAA,CAAM,wBAAwB+B,KAAAA,CAAAA,oBAAAA,EAA4BgC,aAAaG,IAAAA,CAAK,IAAA,CAAA,CAAA,CAAA,EAAS;AAC1FzD,gBAAAA,WAAAA,EAAaH,KAAAA,CAAMG,WAAAA;AACnBE,gBAAAA,OAAAA,EAASL,KAAAA,CAAMK;eACjB,CAAA;AACF,YAAA;AACF,UAAA;AAEA,UAAA,OAAO+C,KAAAA,CAAM;AACX,YAAA,GAAG/B,cAAcC,IAAAA,CAAAA;YACjBzB,IAAAA,EAAM2D;WACR,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMK,UAAAA,CAAW,EACfpC,KAAAA,EACAH,IAAAA,EACA8B,OAAK,EAKL;AACA,UAAA,IAAIL,WAAWzD,aAAAA,CAAcoC,QAAAA,CAASD,KAAAA,CAAAA,IAAUH,KAAKiC,uBAAAA,EAAyB;AAC5E,YAAA,OAAOH,KAAAA,CAAM/B,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQzB,mBAAAA,EAAAA;AACdoD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,YAAA,EAAczB,KAAAA,EAAO+C,UAAAA,CAAAA;AAC9C,UAAA,IAAI,CAAC/C,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOiD,MAAM9B,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAIyB,WAAWpD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMsC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AAGA,UAAA,MAAM8D,YAAYC,KAAAA,CAAMC,OAAAA,CAAQ1C,KAAKzB,IAAI,CAAA,GAAIyB,KAAKzB,IAAAA,GAAO;YAACyB,IAAAA,CAAKzB;;AAC/D,UAAA,MAAM2D,YAAAA,GAAeM,UAAUG,GAAAA,CAAI,CAACC,SAASnE,kBAAAA,CAAmBmE,IAAAA,EAAMlE,KAAAA,EAAO+C,UAAAA,CAAAA,CAAAA;AAE7E,UAAA,OAAOK,KAAAA,CAAM;AACX,YAAA,GAAG/B,cAAcC,IAAAA,CAAAA;AACjBzB,YAAAA,IAAAA,EAAMkE,MAAMC,OAAAA,CAAQ1C,IAAAA,CAAKzB,IAAI,CAAA,GAAI2D,YAAAA,GAAeA,aAAa,CAAA;WAC/D,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMW,mBAAAA,CAAoB,EACxB1C,KAAAA,EACAH,IAAAA,EACA8B,OAAK,EAKL;AACA,UAAA,IAAIL,WAAWzD,aAAAA,CAAcoC,QAAAA,CAASD,KAAAA,CAAAA,IAAUH,KAAKiC,uBAAAA,EAAyB;AAC5E,YAAA,OAAOH,KAAAA,CAAM/B,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQzB,mBAAAA,EAAAA;AACdoD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,qBAAA,EAAuBzB,KAAAA,EAAO+C,UAAAA,CAAAA;AACvD,UAAA,IAAI,CAAC/C,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOiD,MAAM9B,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAIyB,WAAWpD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMsC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AAEA,UAAA,MAAM8D,YAAYC,KAAAA,CAAMC,OAAAA,CAAQ1C,KAAKzB,IAAI,CAAA,GAAIyB,KAAKzB,IAAAA,GAAO;YAACyB,IAAAA,CAAKzB;;AAC/D,UAAA,MAAM2D,YAAAA,GAAeM,UAAUG,GAAAA,CAAI,CAACC,SAASnE,kBAAAA,CAAmBmE,IAAAA,EAAMlE,KAAAA,EAAO+C,UAAAA,CAAAA,CAAAA;AAE7E,UAAA,OAAOK,KAAAA,CAAM;AACX,YAAA,GAAG/B,cAAcC,IAAAA,CAAAA;AACjBzB,YAAAA,IAAAA,EAAMkE,MAAMC,OAAAA,CAAQ1C,IAAAA,CAAKzB,IAAI,CAAA,GAAI2D,YAAAA,GAAeA,aAAa,CAAA;WAC/D,CAAA;AACF,QAAA,CAAA;;;;AAMA,QAAA,MAAMY,MAAAA,CAAO,EACX3C,KAAAA,EACAH,IAAAA,EACA8B,OAAK,EAML;AACA,UAAA,IAAIL,WAAWzD,aAAAA,CAAcoC,QAAAA,CAASD,KAAAA,CAAAA,IAAUH,KAAKiC,uBAAAA,EAAyB;AAC5E,YAAA,OAAOH,KAAAA,CAAM/B,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQzB,mBAAAA,EAAAA;AACdoD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,QAAA,EAAUzB,KAAAA,EAAO+C,UAAAA,CAAAA;AAC1C,UAAA,IAAI,CAAC/C,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOiD,MAAM9B,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAIyB,WAAWpD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMsC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AAEA,UAAA,MAAMwD,YAAAA,GAAe/C,kBAAAA,CAAmBa,IAAAA,CAAKzB,IAAAA,EAAMG,OAAO+C,UAAAA,CAAAA;AAG1D,UAAA,IAAIsB,gBAAgB/C,IAAAA,CAAKX,KAAAA;AACzB,UAAA,IAAIoC,WAAW9D,0BAAAA,IAA8B,CAACuC,2BAAAA,CAA4BC,KAAAA,EAAOsB,UAAAA,CAAAA,EAAa;AAC5FsB,YAAAA,aAAAA,GAAgB3D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAChD,UAAA;AAEA,UAAA,IAAI+C,WAAWrD,KAAAA,EAAO;AACpB,YAAA,MAAM4E,gBAAAA,GAAmBvD,MAAAA,CAAOC,IAAAA,CAAKwC,YAAAA,CAAAA,CAAcE,MAAAA,CAAO,CAACC,CAAAA,KAAM,EAAEA,CAAAA,IAAKrC,IAAAA,CAAKzB,IAAAA,CAAG,CAAA;AAChF,YAAA,MAAM0E,YAAAA,GAAeF,kBAAkB/C,IAAAA,CAAKX,KAAAA;AAC5C,YAAA,IAAI2D,gBAAAA,CAAiBrD,MAAAA,GAAS,CAAA,IAAKsD,YAAAA,EAAc;AAC/CvB,cAAAA,MAAAA,CAAOtD,KAAAA,CACL,CAAA,qBAAA,EAAwB+B,KAAAA,CAAAA,yBAAAA,EAAiC6C,gBAAAA,CAAiBV,IAAAA,CAAK,IAAA,CAAA,CAAA,EAAQW,YAAAA,GAAe,sBAAA,GAAyB,EAAA,CAAA,CAAI,CAAA;AAEvI,YAAA;AACF,UAAA;AAEA,UAAA,OAAOnB,KAAAA,CAAM;AACX,YAAA,GAAG/B,cAAcC,IAAAA,CAAAA;YACjBzB,IAAAA,EAAM2D,YAAAA;YACN7C,KAAAA,EAAO0D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMG,UAAAA,CAAW,EACf/C,KAAAA,EACAH,IAAAA,EACA8B,OAAK,EAML;AACA,UAAA,IAAIL,WAAWzD,aAAAA,CAAcoC,QAAAA,CAASD,KAAAA,CAAAA,IAAUH,KAAKiC,uBAAAA,EAAyB;AAC5E,YAAA,OAAOH,KAAAA,CAAM/B,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQzB,mBAAAA,EAAAA;AACdoD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,YAAA,EAAczB,KAAAA,EAAO+C,UAAAA,CAAAA;AAC9C,UAAA,IAAI,CAAC/C,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOiD,MAAM9B,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAIyB,WAAWpD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMsC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AAEA,UAAA,MAAMwD,YAAAA,GAAe/C,kBAAAA,CAAmBa,IAAAA,CAAKzB,IAAAA,EAAMG,OAAO+C,UAAAA,CAAAA;AAG1D,UAAA,IAAIsB,gBAAgB/C,IAAAA,CAAKX,KAAAA;AACzB,UAAA,IAAIoC,WAAW9D,0BAAAA,IAA8B,CAACuC,2BAAAA,CAA4BC,KAAAA,EAAOsB,UAAAA,CAAAA,EAAa;AAC5FsB,YAAAA,aAAAA,GAAgB3D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAChD,UAAA;AAEA,UAAA,OAAOoD,KAAAA,CAAM;AACX,YAAA,GAAG/B,cAAcC,IAAAA,CAAAA;YACjBzB,IAAAA,EAAM2D,YAAAA;YACN7C,KAAAA,EAAO0D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMI,MAAAA,CAAO,EACXhD,KAAAA,EACAH,IAAAA,EACA8B,OAAK,EAOL;AACA,UAAA,IAAIL,WAAWzD,aAAAA,CAAcoC,QAAAA,CAASD,KAAAA,CAAAA,IAAUH,KAAKiC,uBAAAA,EAAyB;AAC5E,YAAA,OAAOH,KAAAA,CAAM/B,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQzB,mBAAAA,EAAAA;AACdoD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,QAAA,EAAUzB,KAAAA,EAAO+C,UAAAA,CAAAA;AAC1C,UAAA,IAAI,CAAC/C,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOiD,MAAM9B,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAIyB,WAAWpD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMsC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AAEA,UAAA,MAAM0E,cAAAA,GAAiB3E,kBAAAA,CAAmBuB,IAAAA,CAAKgC,MAAAA,EAAQtD,OAAO+C,UAAAA,CAAAA;AAC9D,UAAA,MAAM4B,cAAAA,GAAiBlE,kBAAAA,CAAmBa,IAAAA,CAAK8C,MAAAA,EAAQpE,OAAO+C,UAAAA,CAAAA;AAG9D,UAAA,IAAIsB,gBAAgB/C,IAAAA,CAAKX,KAAAA;AACzB,UAAA,IAAIoC,WAAW9D,0BAAAA,IAA8B,CAACuC,2BAAAA,CAA4BC,KAAAA,EAAOsB,UAAAA,CAAAA,EAAa;AAC5FsB,YAAAA,aAAAA,GAAgB3D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAChD,UAAA;AAEA,UAAA,OAAOoD,KAAAA,CAAM;AACX,YAAA,GAAG/B,cAAcC,IAAAA,CAAAA;YACjBgC,MAAAA,EAAQoB,cAAAA;YACRN,MAAAA,EAAQO,cAAAA;YACRhE,KAAAA,EAAO0D;WACT,CAAA;AACF,QAAA,CAAA;;;;AAMA,QAAA,MAAMO,QAAAA,CAAS,EAAEnD,KAAAA,EAAOH,IAAAA,EAAM8B,OAAK,EAAqC;AACtE,UAAA,IACE,CAACL,WAAWhE,mBAAAA,IACZyC,2BAAAA,CAA4BC,OAAOsB,UAAAA,CAAAA,IACnCzB,KAAKiC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAM/B,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQzB,mBAAAA,EAAAA;AACdoD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,UAAA,EAAYzB,KAAAA,EAAO+C,UAAAA,CAAAA;AAC5C,UAAA,IAAI,CAAC/C,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOiD,MAAM9B,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAIyB,WAAWpD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMsC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AAEA,UAAA,MAAMqE,aAAAA,GAAgB3D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAI+C,WAAWrD,KAAAA,EAAO;AACpBsD,YAAAA,MAAAA,CAAOtD,KAAAA,CAAM,CAAA,qBAAA,EAAwB+B,KAAAA,CAAAA,2CAAAA,CAAAA,EAAoD;AACvFtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOiD,KAAAA,CAAM;AACX,YAAA,GAAG/B,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO0D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMQ,SAAAA,CAAU,EAAEpD,KAAAA,EAAOH,IAAAA,EAAM8B,OAAK,EAAqC;AACvE,UAAA,IACE,CAACL,WAAWhE,mBAAAA,IACZyC,2BAAAA,CAA4BC,OAAOsB,UAAAA,CAAAA,IACnCzB,KAAKiC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAM/B,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQzB,mBAAAA,EAAAA;AACdoD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,WAAA,EAAazB,KAAAA,EAAO+C,UAAAA,CAAAA;AAC7C,UAAA,IAAI,CAAC/C,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOiD,MAAM9B,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAIyB,WAAWpD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMsC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AAEA,UAAA,MAAMqE,aAAAA,GAAgB3D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAI+C,WAAWrD,KAAAA,EAAO;AACpBsD,YAAAA,MAAAA,CAAOtD,KAAAA,CAAM,CAAA,qBAAA,EAAwB+B,KAAAA,CAAAA,4CAAAA,CAAAA,EAAqD;AACxFtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOiD,KAAAA,CAAM;AACX,YAAA,GAAG/B,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO0D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMS,gBAAAA,CAAiB,EAAErD,KAAAA,EAAOH,IAAAA,EAAM8B,OAAK,EAAqC;AAC9E,UAAA,IACE,CAACL,WAAWhE,mBAAAA,IACZyC,2BAAAA,CAA4BC,OAAOsB,UAAAA,CAAAA,IACnCzB,KAAKiC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAM/B,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQzB,mBAAAA,EAAAA;AACdoD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,kBAAA,EAAoBzB,KAAAA,EAAO+C,UAAAA,CAAAA;AACpD,UAAA,IAAI,CAAC/C,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOiD,MAAM9B,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAIyB,WAAWpD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMsC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AAEA,UAAA,MAAMqE,aAAAA,GAAgB3D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAI+C,WAAWrD,KAAAA,EAAO;AACpBsD,YAAAA,MAAAA,CAAOtD,KAAAA,CAAM,CAAA,qBAAA,EAAwB+B,KAAAA,CAAAA,mDAAAA,CAAAA,EAA4D;AAC/FtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOiD,KAAAA,CAAM;AACX,YAAA,GAAG/B,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO0D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMU,UAAAA,CAAW,EAAEtD,KAAAA,EAAOH,IAAAA,EAAM8B,OAAK,EAAqC;AACxE,UAAA,IACE,CAACL,WAAWhE,mBAAAA,IACZyC,2BAAAA,CAA4BC,OAAOsB,UAAAA,CAAAA,IACnCzB,KAAKiC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAM/B,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQzB,mBAAAA,EAAAA;AACdoD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,YAAA,EAAczB,KAAAA,EAAO+C,UAAAA,CAAAA;AAC9C,UAAA,IAAI,CAAC/C,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOiD,MAAM9B,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAIyB,WAAWpD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMsC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AAKA,UAAA,MAAMqE,aAAAA,GAAgB3D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAI+C,WAAWrD,KAAAA,EAAO;AACpBsD,YAAAA,MAAAA,CAAOtD,KAAAA,CAAM,CAAA,qBAAA,EAAwB+B,KAAAA,CAAAA,6CAAAA,CAAAA,EAAsD;AACzFtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOiD,KAAAA,CAAM;AACX,YAAA,GAAG/B,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO0D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMW,iBAAAA,CAAkB,EAAEvD,KAAAA,EAAOH,IAAAA,EAAM8B,OAAK,EAAqC;AAC/E,UAAA,IACE,CAACL,WAAWhE,mBAAAA,IACZyC,2BAAAA,CAA4BC,OAAOsB,UAAAA,CAAAA,IACnCzB,KAAKiC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAM/B,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQzB,mBAAAA,EAAAA;AACdoD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,mBAAA,EAAqBzB,KAAAA,EAAO+C,UAAAA,CAAAA;AACrD,UAAA,IAAI,CAAC/C,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOiD,MAAM9B,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAIyB,WAAWpD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMsC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AAEA,UAAA,MAAMqE,aAAAA,GAAgB3D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAI+C,WAAWrD,KAAAA,EAAO;AACpBsD,YAAAA,MAAAA,CAAOtD,KAAAA,CAAM,CAAA,qBAAA,EAAwB+B,KAAAA,CAAAA,oDAAAA,CAAAA,EAA6D;AAChGtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOiD,KAAAA,CAAM;AACX,YAAA,GAAG/B,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO0D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMY,KAAAA,CAAM,EAAExD,KAAAA,EAAOH,IAAAA,EAAM8B,OAAK,EAAqC;AACnE,UAAA,IACE,CAACL,WAAWhE,mBAAAA,IACZyC,2BAAAA,CAA4BC,OAAOsB,UAAAA,CAAAA,IACnCzB,KAAKiC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAM/B,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQzB,mBAAAA,EAAAA;AACdoD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,OAAA,EAASzB,KAAAA,EAAO+C,UAAAA,CAAAA;AACzC,UAAA,IAAI,CAAC/C,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOiD,MAAM9B,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAIyB,WAAWpD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMsC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AAEA,UAAA,MAAMqE,aAAAA,GAAgB3D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAI+C,WAAWrD,KAAAA,EAAO;AACpBsD,YAAAA,MAAAA,CAAOtD,KAAAA,CAAM,CAAA,qBAAA,EAAwB+B,KAAAA,CAAAA,wCAAAA,CAAAA,EAAiD;AACpFtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOiD,KAAAA,CAAM;AACX,YAAA,GAAG/B,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO0D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMa,SAAAA,CAAU,EAAEzD,KAAAA,EAAOH,IAAAA,EAAM8B,OAAK,EAAqC;AACvE,UAAA,IACE,CAACL,WAAWhE,mBAAAA,IACZyC,2BAAAA,CAA4BC,OAAOsB,UAAAA,CAAAA,IACnCzB,KAAKiC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAM/B,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQzB,mBAAAA,EAAAA;AACdoD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,WAAA,EAAazB,KAAAA,EAAO+C,UAAAA,CAAAA;AAC7C,UAAA,IAAI,CAAC/C,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOiD,MAAM9B,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAIyB,WAAWpD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMsC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AAEA,UAAA,MAAMqE,aAAAA,GAAgB3D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAI+C,WAAWrD,KAAAA,EAAO;AACpBsD,YAAAA,MAAAA,CAAOtD,KAAAA,CAAM,CAAA,qBAAA,EAAwB+B,KAAAA,CAAAA,4CAAAA,CAAAA,EAAqD;AACxFtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOiD,KAAAA,CAAM;AACX,YAAA,GAAG/B,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO0D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMc,OAAAA,CAAQ,EAAE1D,KAAAA,EAAOH,IAAAA,EAAM8B,OAAK,EAAqC;AACrE,UAAA,IACE,CAACL,WAAWhE,mBAAAA,IACZyC,2BAAAA,CAA4BC,OAAOsB,UAAAA,CAAAA,IACnCzB,KAAKiC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAM/B,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQzB,mBAAAA,EAAAA;AACdoD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,SAAA,EAAWzB,KAAAA,EAAO+C,UAAAA,CAAAA;AAC3C,UAAA,IAAI,CAAC/C,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOiD,MAAM9B,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAIyB,WAAWpD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMsC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AAEA,UAAA,MAAMqE,aAAAA,GAAgB3D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAI+C,WAAWrD,KAAAA,EAAO;AACpBsD,YAAAA,MAAAA,CAAOtD,KAAAA,CAAM,CAAA,qBAAA,EAAwB+B,KAAAA,CAAAA,0CAAAA,CAAAA,EAAmD;AACtFtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOiD,KAAAA,CAAM;AACX,YAAA,GAAG/B,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO0D;WACT,CAAA;AACF,QAAA,CAAA;;;;AAMA,QAAA,MAAMzB,MAAAA,CAAO,EAAEnB,KAAAA,EAAOH,IAAAA,EAAM8B,OAAK,EAAqC;AACpE,UAAA,IACE,CAACL,WAAW/D,qBAAAA,IACZwC,2BAAAA,CAA4BC,OAAOsB,UAAAA,CAAAA,IACnCzB,KAAKiC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAM/B,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQzB,mBAAAA,EAAAA;AACdoD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,QAAA,EAAUzB,KAAAA,EAAO+C,UAAAA,CAAAA;AAC1C,UAAA,IAAI,CAAC/C,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOiD,MAAM9B,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAIyB,WAAWpD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMsC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AAEA,UAAA,MAAMqE,aAAAA,GAAgB3D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAI+C,WAAWrD,KAAAA,EAAO;AACpBsD,YAAAA,MAAAA,CAAOtD,KAAAA,CAAM,CAAA,qBAAA,EAAwB+B,KAAAA,CAAAA,yCAAAA,CAAAA,EAAkD;AACrFtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOiD,KAAAA,CAAM;AACX,YAAA,GAAG/B,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO0D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMe,UAAAA,CAAW,EAAE3D,KAAAA,EAAOH,IAAAA,EAAM8B,OAAK,EAAqC;AACxE,UAAA,IACE,CAACL,WAAW/D,qBAAAA,IACZwC,2BAAAA,CAA4BC,OAAOsB,UAAAA,CAAAA,IACnCzB,KAAKiC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAM/B,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQzB,mBAAAA,EAAAA;AACdoD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,YAAA,EAAczB,KAAAA,EAAO+C,UAAAA,CAAAA;AAC9C,UAAA,IAAI,CAAC/C,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOiD,MAAM9B,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAIyB,WAAWpD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMsC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AAEA,UAAA,MAAMqE,aAAAA,GAAgB3D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAI+C,WAAWrD,KAAAA,EAAO;AACpBsD,YAAAA,MAAAA,CAAOtD,KAAAA,CAAM,CAAA,qBAAA,EAAwB+B,KAAAA,CAAAA,6CAAAA,CAAAA,EAAsD;AACzFtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOiD,KAAAA,CAAM;AACX,YAAA,GAAG/B,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO0D;WACT,CAAA;AACF,QAAA;AACF;AACF;GACF,CAAA;AACF;AAhnBgBxB,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA","file":"chunk-QLXIIF4I.js","sourcesContent":["/**\n * Prisma Workspace Extension\n *\n * Automatically injects workspaceId into ALL Prisma operations using\n * request-scoped context from AsyncLocalStorage:\n *\n * **Write operations** (create, createMany, update, upsert):\n * - Auto-populates `workspaceId`, `tenantId`, `createdBy`, `updatedBy`, `context` JSON\n *\n * **Read operations** (findMany, findFirst, findUnique, count, aggregate, groupBy):\n * - Auto-injects `workspaceId` into the `where` clause for workspace isolation\n *\n * **Delete operations** (delete, deleteMany):\n * - Auto-injects `workspaceId` into the `where` clause to prevent cross-workspace deletion\n *\n * **Update where clause** (update, updateMany):\n * - Auto-injects `workspaceId` into the `where` clause to prevent cross-workspace updates\n *\n * **How it works:**\n * 1. The GraphQL server's buildContext extracts workspaceId from x-workspace-id header\n * 2. The workspace context store (AsyncLocalStorage) holds the current request's workspace info\n * 3. This Prisma extension intercepts ALL operations and auto-injects workspaceId\n *\n * **What gets auto-populated on writes:**\n * - `workspaceId` field (String or String?) - set from context if not explicitly provided\n * - `context` field (Json) - merged with workspace/actor info if not explicitly provided\n * - `tenantId` field (String or String?) - set from context if not explicitly provided\n * - `createdBy` / `updatedBy` fields - set from actor context if not explicitly provided\n *\n * **What gets auto-injected on reads/updates/deletes:**\n * - `workspaceId` in the `where` clause - ensures queries only access data within the workspace\n *\n * **Opt-out:**\n * - Explicitly providing `workspaceId` in the where/data will override auto-injection\n * - Pass `_skipWorkspaceInjection: true` in the query args to skip entirely\n * - Set `enableReadIsolation: false` in config to disable read-side injection only\n * - Add model names to `excludeModels` to skip specific models\n *\n * @module prisma/workspace-extension\n * @category Database\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { logger } from '../logger/index.js';\nimport type { InputJsonValue } from './context.js';\n\n// ============================================================================\n// Workspace Context Store (AsyncLocalStorage)\n// ============================================================================\n\n/**\n * Workspace context for the current request scope\n */\nexport interface WorkspaceContext {\n  /** Workspace ID (from x-workspace-id header) */\n  workspaceId?: string;\n  /** Tenant ID (from x-tenant-id header or derived from workspace) */\n  tenantId?: string;\n  /** Actor ID (user/service/app performing the operation) */\n  actorId?: string;\n  /** Actor type (user, app, service, super_admin) */\n  actorType?: string;\n  /** Organization ID */\n  organizationId?: string;\n  /** Project ID */\n  projectId?: string;\n  /** App ID */\n  appId?: string;\n  /** On behalf of actor ID (for consent-based delegation) */\n  onBehalfOf?: string;\n}\n\n/**\n * AsyncLocalStorage for workspace context\n * This is separate from the SDK's general ContextManager to allow\n * fine-grained control over workspace-specific context propagation.\n */\nconst workspaceContextStore = new AsyncLocalStorage<WorkspaceContext>();\n\n/**\n * Fallback context for environments where AsyncLocalStorage.enterWith()\n * doesn't propagate across async boundaries (e.g., Bun + GraphQL Yoga).\n *\n * IMPORTANT: This is NOT request-isolated — it's a module-level singleton.\n * It works for single-request-at-a-time scenarios but could race under\n * concurrent requests. The ALS is the primary mechanism; this is a fallback.\n */\nlet fallbackContext: WorkspaceContext | undefined;\n\n/**\n * Set workspace context for the current async scope.\n * Call this in your GraphQL context builder or middleware.\n *\n * Uses AsyncLocalStorage.enterWith() as the primary mechanism,\n * with a module-level fallback for runtimes where enterWith()\n * doesn't propagate through all async chains (e.g., Bun).\n *\n * @param context - The workspace context for this request\n *\n * @example\n * ```typescript\n * // In your server's buildContext:\n * import { setWorkspaceContext } from '@burdenoff/be-sdk/prisma';\n *\n * buildContext: async (defaultContext) => {\n *   setWorkspaceContext({\n *     workspaceId: defaultContext.workspace?.id,\n *     tenantId: defaultContext.tenant?.id,\n *     actorId: defaultContext.actor?.id,\n *     actorType: defaultContext.actor?.type,\n *     organizationId: defaultContext.organization?.id,\n *   });\n *   return defaultContext;\n * }\n * ```\n */\nexport function setWorkspaceContext(context: WorkspaceContext): void {\n  workspaceContextStore.enterWith(context);\n  fallbackContext = context;\n}\n\n/**\n * Get the current workspace context from AsyncLocalStorage.\n * Falls back to module-level context if ALS returns undefined\n * (can happen in Bun where enterWith() doesn't propagate through\n * some async chains like GraphQL Yoga's execution pipeline).\n *\n * @returns The current workspace context, or undefined if not set\n */\nexport function getWorkspaceContext(): WorkspaceContext | undefined {\n  return workspaceContextStore.getStore() ?? fallbackContext;\n}\n\n/**\n * Run a function with a specific workspace context.\n * The context is isolated to this execution and its children.\n *\n * @param context - The workspace context\n * @param fn - The function to run\n * @returns The result of the function\n *\n * @example\n * ```typescript\n * const result = await withWorkspaceContext(\n *   { workspaceId: 'ws-123', actorId: 'user-456' },\n *   async () => {\n *     // All Prisma operations in here will auto-inject workspaceId\n *     return await prisma.tag.create({ data: { name: 'test' } });\n *   }\n * );\n * ```\n */\nexport async function withWorkspaceContext<T>(context: WorkspaceContext, fn: () => Promise<T>): Promise<T> {\n  return workspaceContextStore.run(context, fn);\n}\n\n/**\n * Run a synchronous function with a specific workspace context.\n */\nexport function withWorkspaceContextSync<T>(context: WorkspaceContext, fn: () => T): T {\n  return workspaceContextStore.run(context, fn);\n}\n\n// ============================================================================\n// Extension Configuration\n// ============================================================================\n\n/**\n * Configuration for the workspace extension\n */\nexport interface WorkspaceExtensionConfig {\n  /**\n   * Enable automatic workspaceId injection on create/update\n   * @default true\n   */\n  enabled?: boolean;\n\n  /**\n   * Enable automatic workspaceId injection on read operations\n   * (findMany, findFirst, findUnique, findFirstOrThrow, findUniqueOrThrow,\n   *  count, aggregate, groupBy)\n   *\n   * When enabled, every read query automatically includes `workspaceId`\n   * in the `where` clause, preventing cross-workspace data leakage.\n   *\n   * @default true\n   */\n  enableReadIsolation?: boolean;\n\n  /**\n   * Enable automatic workspaceId injection on delete operations\n   * (delete, deleteMany)\n   *\n   * When enabled, every delete operation automatically includes `workspaceId`\n   * in the `where` clause, preventing cross-workspace deletion.\n   *\n   * @default true\n   */\n  enableDeleteIsolation?: boolean;\n\n  /**\n   * Enable automatic workspaceId injection into update/updateMany `where` clauses.\n   *\n   * When enabled, update operations automatically include `workspaceId`\n   * in the `where` clause in addition to the `data` injection,\n   * preventing cross-workspace updates.\n   *\n   * @default true\n   */\n  enableUpdateWhereIsolation?: boolean;\n\n  /**\n   * Automatically populate the `context` JSON field with workspace/actor info\n   * @default true\n   */\n  populateContextJson?: boolean;\n\n  /**\n   * Automatically populate `createdBy` field on create operations\n   * @default true\n   */\n  populateCreatedBy?: boolean;\n\n  /**\n   * Automatically populate `updatedBy` field on update operations\n   * @default true\n   */\n  populateUpdatedBy?: boolean;\n\n  /**\n   * Automatically populate `tenantId` field from context\n   * @default false (tenantId is typically derived from workspaceId at the DB level)\n   */\n  populateTenantId?: boolean;\n\n  /**\n   * Models to exclude from auto-injection (both reads and writes).\n   * Use this for models that intentionally don't have workspaceId.\n   *\n   * Common exclusions: system tables, infra tables, global reference data.\n   *\n   * @default []\n   */\n  excludeModels?: string[];\n\n  /**\n   * Models to exclude from read isolation only.\n   * These models will still get write-side injection (workspaceId on create)\n   * but reads will NOT have workspaceId auto-injected into `where`.\n   *\n   * Use this for child/join tables where workspace scoping is inherited\n   * through parent relations, or for models queried by ID that don't\n   * have a workspaceId column.\n   *\n   * @default []\n   */\n  excludeModelsFromReadIsolation?: string[];\n\n  /**\n   * When true, throws an error if workspaceId is missing from context\n   * for any non-excluded model operation. This prevents silent\n   * workspace-unscoped queries that could leak data across workspaces.\n   *\n   * When false, operations without workspace context proceed without\n   * workspaceId injection (legacy behavior).\n   *\n   * @default true\n   */\n  strictMode?: boolean;\n\n  /**\n   * Operations that are allowed without workspace context even in strict mode.\n   * Use `Model.operation` format (e.g., `['Workspace.create', 'RevokedToken.findMany']`).\n   *\n   * Valid operation names: create, createMany, createManyAndReturn, update, updateMany,\n   * upsert, findMany, findFirst, findFirstOrThrow, findUnique, findUniqueOrThrow,\n   * count, aggregate, groupBy, delete, deleteMany.\n   *\n   * @default []\n   */\n  allowedUnguardedOperations?: string[];\n\n  /**\n   * Log injection events (useful for debugging)\n   * @default false\n   */\n  debug?: boolean;\n\n  /**\n   * Tag the PostgreSQL connection with workspace attribution for pg_stat_activity visibility.\n   *\n   * When enabled, the first DB operation per workspace context sets:\n   *   `application_name = 'svc=<SERVICE_NAME>;ws=<workspaceId>'`\n   *\n   * This makes workspace-level query attribution visible in pg_stat_activity,\n   * pg_locks, auto_explain, and monitoring tools without any schema changes.\n   * Subsequent operations in the same request are deduplicated via WeakSet,\n   * costing ~0 overhead after the first round-trip per request context.\n   *\n   * NOTE: This is a session-level SET so attribution may drift across ops\n   * that reuse the same pooled connection from different requests. Use for\n   * aggregate observability, not per-query forensics.\n   *\n   * @default false\n   */\n  enableApplicationNameTagging?: boolean;\n}\n\n/**\n * Default configuration\n */\nconst defaultConfig: Required<WorkspaceExtensionConfig> = {\n  enabled: true,\n  enableReadIsolation: true,\n  enableDeleteIsolation: true,\n  enableUpdateWhereIsolation: true,\n  populateContextJson: true,\n  populateCreatedBy: true,\n  populateUpdatedBy: true,\n  populateTenantId: false,\n  excludeModels: [],\n  excludeModelsFromReadIsolation: [],\n  strictMode: true,\n  allowedUnguardedOperations: [],\n  debug: false,\n  enableApplicationNameTagging: false,\n};\n\n// ============================================================================\n// Data Injection Helpers\n// ============================================================================\n\n/**\n * Check if a field exists in the data object (including being set to null/undefined explicitly)\n */\nfunction hasField(data: Record<string, unknown>, field: string): boolean {\n  return field in data;\n}\n\n/**\n * Inject workspace-related fields into create data\n */\nfunction injectCreateFields(\n  data: Record<string, unknown>,\n  wsCtx: WorkspaceContext,\n  config: Required<WorkspaceExtensionConfig>\n): Record<string, unknown> {\n  const injected = { ...data };\n\n  // Inject workspaceId if not already provided\n  if (wsCtx.workspaceId && !hasField(injected, 'workspaceId')) {\n    injected['workspaceId'] = wsCtx.workspaceId;\n  }\n\n  // Inject tenantId if configured and not already provided\n  if (config.populateTenantId && wsCtx.tenantId && !hasField(injected, 'tenantId')) {\n    injected['tenantId'] = wsCtx.tenantId;\n  }\n\n  // Inject createdBy if configured and not already provided\n  if (config.populateCreatedBy && wsCtx.actorId && !hasField(injected, 'createdBy')) {\n    injected['createdBy'] = wsCtx.actorId;\n  }\n\n  // Inject updatedBy on create as well (initial value)\n  if (config.populateUpdatedBy && wsCtx.actorId && !hasField(injected, 'updatedBy')) {\n    injected['updatedBy'] = wsCtx.actorId;\n  }\n\n  // Inject onBehalfOf (for consent-based delegation tracking)\n  // If onBehalfOf is in context (from consent), use it; otherwise defaults to actorId (self-action)\n  if (wsCtx.onBehalfOf && !hasField(injected, 'onBehalfOf')) {\n    injected['onBehalfOf'] = wsCtx.onBehalfOf;\n  } else if (wsCtx.actorId && !hasField(injected, 'onBehalfOf')) {\n    // Default to actorId if no delegation (self-action)\n    injected['onBehalfOf'] = wsCtx.actorId;\n  }\n\n  // Populate context JSON field\n  if (config.populateContextJson && !hasField(injected, 'context')) {\n    const contextJson = buildContextJsonFromWorkspaceContext(wsCtx);\n    if (contextJson) {\n      injected['context'] = contextJson;\n    }\n  }\n\n  return injected;\n}\n\n/**\n * Inject workspace-related fields into update data\n */\nfunction injectUpdateFields(\n  data: Record<string, unknown>,\n  wsCtx: WorkspaceContext,\n  config: Required<WorkspaceExtensionConfig>\n): Record<string, unknown> {\n  const injected = { ...data };\n\n  // Inject updatedBy if configured and not already provided\n  if (config.populateUpdatedBy && wsCtx.actorId && !hasField(injected, 'updatedBy')) {\n    injected['updatedBy'] = wsCtx.actorId;\n  }\n\n  // Note: We intentionally do NOT auto-inject workspaceId on updates\n  // because updates target existing records (workspaceId is immutable after creation)\n  // and changing it would be a data integrity issue.\n\n  return injected;\n}\n\n/**\n * Inject workspaceId into a where clause.\n * Only injects if workspaceId is available in context and not already present in where.\n *\n * For operations that may not have a where clause (e.g., findMany without filters),\n * creates a new where object with just workspaceId.\n */\nfunction injectWhereClause(\n  where: Record<string, unknown> | undefined,\n  wsCtx: WorkspaceContext\n): Record<string, unknown> | undefined {\n  if (!wsCtx.workspaceId) return where;\n\n  if (!where) {\n    // No where clause exists, create one with just workspaceId\n    return { workspaceId: wsCtx.workspaceId };\n  }\n\n  // Only inject if not already present\n  if (!hasField(where, 'workspaceId')) {\n    return { ...where, workspaceId: wsCtx.workspaceId };\n  }\n\n  return where;\n}\n\n/**\n * Build context JSON from workspace context\n */\nfunction buildContextJsonFromWorkspaceContext(wsCtx: WorkspaceContext): InputJsonValue | undefined {\n  const context: Record<string, string> = {};\n\n  if (wsCtx.workspaceId) context['workspaceId'] = wsCtx.workspaceId;\n  if (wsCtx.actorId) context['userId'] = wsCtx.actorId;\n  if (wsCtx.organizationId) context['organizationId'] = wsCtx.organizationId;\n  if (wsCtx.projectId) context['projectId'] = wsCtx.projectId;\n  if (wsCtx.appId) context['appId'] = wsCtx.appId;\n\n  return Object.keys(context).length > 0 ? context : undefined;\n}\n\n/**\n * Inject workspaceId into where clause for read/update/delete operations.\n * This is a utility function exported for services that want to manually\n * add workspace scoping to their queries.\n *\n * @param where - The existing where clause\n * @param wsCtx - The workspace context (or auto-detected from AsyncLocalStorage)\n * @returns The where clause with workspaceId injected if not already present\n *\n * @example\n * ```typescript\n * import { injectWhereWorkspaceId, getWorkspaceContext } from '@burdenoff/be-sdk/prisma';\n *\n * const wsCtx = getWorkspaceContext();\n * const where = injectWhereWorkspaceId({ status: 'ACTIVE' }, wsCtx);\n * // Result: { status: 'ACTIVE', workspaceId: 'ws-123' }\n * ```\n */\nexport function injectWhereWorkspaceId(\n  where: Record<string, unknown> | undefined,\n  wsCtx?: WorkspaceContext\n): Record<string, unknown> | undefined {\n  const ctx = wsCtx ?? getWorkspaceContext();\n  if (!where || !ctx?.workspaceId) return where;\n\n  // Only inject if not already present\n  if (!hasField(where, 'workspaceId')) {\n    return { ...where, workspaceId: ctx.workspaceId };\n  }\n\n  return where;\n}\n\n/**\n * Remove the _skipWorkspaceInjection flag from args before passing to Prisma.\n * Using a dedicated function avoids ESLint unused-variable warnings from destructuring.\n */\nfunction stripSkipFlag<T extends Record<string, unknown>>(args: T): Omit<T, '_skipWorkspaceInjection'> {\n  const cleaned = { ...args };\n  delete (cleaned as Record<string, unknown>)['_skipWorkspaceInjection'];\n  return cleaned;\n}\n\n/**\n * Check if a model should be excluded from read isolation.\n * A model is excluded if it's in excludeModels OR excludeModelsFromReadIsolation.\n */\nfunction isExcludedFromReadIsolation(model: string, config: Required<WorkspaceExtensionConfig>): boolean {\n  return config.excludeModels.includes(model) || config.excludeModelsFromReadIsolation.includes(model);\n}\n\n// ============================================================================\n// Strict Mode Enforcement\n// ============================================================================\n\n/**\n * Enforce strict mode: throw if workspace context is missing and the operation\n * is not explicitly allowed to run without it.\n *\n * @returns true if the operation should proceed without workspace injection (non-strict or allowed)\n * @throws Error if strict mode is enabled and the operation is not allowed\n */\nfunction enforceStrictMode(\n  model: string,\n  operation: string,\n  wsCtx: WorkspaceContext | undefined,\n  config: Required<WorkspaceExtensionConfig>\n): void {\n  // If workspace context has a workspaceId, nothing to enforce\n  if (wsCtx?.workspaceId) return;\n\n  // If strict mode is off, allow silently\n  if (!config.strictMode) return;\n\n  // Check if this specific operation is allowed without workspace context\n  const opKey = `${model}.${operation}`;\n  if (config.allowedUnguardedOperations.includes(opKey)) return;\n\n  // Strict mode violation — throw\n  throw new Error(\n    `[WorkspaceExtension] Workspace context required for ${model}.${operation}. ` +\n      `No workspaceId found in request context. To bypass, either: ` +\n      `(1) add \"${model}\" to excludeModels, ` +\n      `(2) add \"${opKey}\" to allowedUnguardedOperations, or ` +\n      `(3) pass _skipWorkspaceInjection: true in the query args.`\n  );\n}\n\n// ============================================================================\n// Prisma Extension\n// ============================================================================\n\n/**\n * Standard args shape for operations with a `where` clause\n */\ninterface WhereArgs {\n  where?: Record<string, unknown>;\n  _skipWorkspaceInjection?: boolean;\n  [key: string]: unknown;\n}\n\n/**\n * Standard handler params from Prisma $extends\n */\ninterface ExtensionHandlerParams<TArgs> {\n  model: string;\n  args: TArgs;\n  query: (args: unknown) => Promise<unknown>;\n}\n\n/**\n * Add workspace extension to a Prisma client.\n *\n * This extension provides comprehensive workspace isolation by automatically\n * injecting workspaceId into ALL Prisma operations:\n *\n * **Writes**: Auto-populates workspaceId, tenantId, createdBy, updatedBy, context JSON\n * **Reads**: Auto-injects workspaceId into where clause (findMany, findFirst, etc.)\n * **Updates**: Auto-injects workspaceId into where clause + updatedBy into data\n * **Deletes**: Auto-injects workspaceId into where clause\n *\n * **Chain order matters**: Apply this extension AFTER the graph extension\n * (handled automatically by createDatabaseClient).\n *\n * @param baseClient - The Prisma client to extend\n * @param config - Extension configuration\n * @returns Extended Prisma client with workspace auto-injection\n *\n * @example\n * ```typescript\n * import { PrismaClient } from './generated/prisma/client.js';\n * import { addWorkspaceExtension } from '@burdenoff/be-sdk/prisma';\n *\n * const baseClient = new PrismaClient({ adapter });\n * const client = addWorkspaceExtension(baseClient, {\n *   populateContextJson: true,\n *   populateCreatedBy: true,\n *   enableReadIsolation: true,\n *   debug: process.env.NODE_ENV === 'development',\n *   excludeModels: ['CircuitBreakerState', 'SchedulerState'],\n *   excludeModelsFromReadIsolation: ['Permission', 'RbacResourceType'],\n * });\n * ```\n */\n// ============================================================================\n// Connection Tagging (Phase 0.2)\n// ============================================================================\n\n/** Minimal Prisma raw-exec surface needed for SET application_name */\ntype RawPrismaForTagging = {\n  $executeRawUnsafe: (query: string, ...values: unknown[]) => Promise<number>;\n};\n\n/**\n * WeakSet of contexts that have already had the connection tagged this request.\n * WorkspaceContext objects live only for the duration of a request, so entries\n * are automatically GC'd when the context goes out of scope — no manual cleanup.\n */\nconst taggedContexts = new WeakSet<WorkspaceContext>();\n\n/**\n * Tag the current Postgres connection with workspace attribution (once per context).\n * Sets `application_name = 'svc=<name>;ws=<workspaceId>'` at the session level.\n * Non-fatal: tagging failures are swallowed so the main operation still proceeds.\n *\n * @internal Exported for unit testing only — do not call from product code.\n */\nexport async function maybeTagConnection(rawPrisma: RawPrismaForTagging, wsCtx: WorkspaceContext): Promise<void> {\n  if (taggedContexts.has(wsCtx)) return;\n  taggedContexts.add(wsCtx);\n  // Strip non-safe chars; workspace IDs are UUIDs/CUIDs, service names are kebab-case\n  const safeSvc = (process.env['SERVICE_NAME'] ?? 'svc').replace(/[^a-zA-Z0-9\\-_]/g, '');\n  const safeWs = (wsCtx.workspaceId ?? '').replace(/[^a-zA-Z0-9\\-_]/g, '');\n  const tag = `svc=${safeSvc};ws=${safeWs}`;\n  try {\n    await rawPrisma.$executeRawUnsafe(`SET application_name = '${tag}'`);\n  } catch {\n    // Retry on the next operation if this one failed\n    taggedContexts.delete(wsCtx);\n  }\n}\n\nexport function addWorkspaceExtension<T>(baseClient: T, config?: WorkspaceExtensionConfig): T {\n  const fullConfig: Required<WorkspaceExtensionConfig> = {\n    ...defaultConfig,\n    ...config,\n  };\n\n  if (!fullConfig.enabled) {\n    logger.info('[WorkspaceExtension] Extension disabled by configuration');\n    return baseClient;\n  }\n\n  // Capture the unwrapped client for connection tagging (pre-extension, avoids recursion)\n  const rawPrisma = baseClient as unknown as RawPrismaForTagging;\n\n  // Type assertion for Prisma client $extends\n  const prismaClient = baseClient as { $extends: (args: unknown) => T };\n\n  logger.info('[WorkspaceExtension] Workspace extension enabled', {\n    populateContextJson: fullConfig.populateContextJson,\n    populateCreatedBy: fullConfig.populateCreatedBy,\n    populateUpdatedBy: fullConfig.populateUpdatedBy,\n    populateTenantId: fullConfig.populateTenantId,\n    enableReadIsolation: fullConfig.enableReadIsolation,\n    enableDeleteIsolation: fullConfig.enableDeleteIsolation,\n    enableUpdateWhereIsolation: fullConfig.enableUpdateWhereIsolation,\n    strictMode: fullConfig.strictMode,\n    excludeModels: fullConfig.excludeModels,\n    excludeModelsFromReadIsolation: fullConfig.excludeModelsFromReadIsolation,\n    allowedUnguardedOperations: fullConfig.allowedUnguardedOperations,\n    enableApplicationNameTagging: fullConfig.enableApplicationNameTagging,\n  });\n\n  return prismaClient.$extends({\n    query: {\n      $allModels: {\n        // ================================================================\n        // WRITE OPERATIONS - inject workspaceId into data\n        // ================================================================\n\n        async create({\n          model,\n          args,\n          query,\n        }: ExtensionHandlerParams<{\n          data: Record<string, unknown>;\n          _skipWorkspaceInjection?: boolean;\n          [key: string]: unknown;\n        }>) {\n          // Skip if model is excluded or injection is explicitly skipped\n          if (fullConfig.excludeModels.includes(model) || args._skipWorkspaceInjection) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'create', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n\n          // Inject fields into data\n          const injectedData = injectCreateFields(args.data, wsCtx, fullConfig);\n\n          if (fullConfig.debug) {\n            const injectedKeys = Object.keys(injectedData).filter((k) => !(k in args.data));\n            if (injectedKeys.length > 0) {\n              logger.debug(`[WorkspaceExtension] ${model}.create - injected: ${injectedKeys.join(', ')}`, {\n                workspaceId: wsCtx.workspaceId,\n                actorId: wsCtx.actorId,\n              });\n            }\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            data: injectedData,\n          });\n        },\n\n        async createMany({\n          model,\n          args,\n          query,\n        }: ExtensionHandlerParams<{\n          data: Record<string, unknown> | Record<string, unknown>[];\n          _skipWorkspaceInjection?: boolean;\n          [key: string]: unknown;\n        }>) {\n          if (fullConfig.excludeModels.includes(model) || args._skipWorkspaceInjection) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'createMany', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n\n          // Handle both single object and array\n          const dataArray = Array.isArray(args.data) ? args.data : [args.data];\n          const injectedData = dataArray.map((item) => injectCreateFields(item, wsCtx, fullConfig));\n\n          return query({\n            ...stripSkipFlag(args),\n            data: Array.isArray(args.data) ? injectedData : injectedData[0],\n          });\n        },\n\n        async createManyAndReturn({\n          model,\n          args,\n          query,\n        }: ExtensionHandlerParams<{\n          data: Record<string, unknown> | Record<string, unknown>[];\n          _skipWorkspaceInjection?: boolean;\n          [key: string]: unknown;\n        }>) {\n          if (fullConfig.excludeModels.includes(model) || args._skipWorkspaceInjection) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'createManyAndReturn', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n\n          const dataArray = Array.isArray(args.data) ? args.data : [args.data];\n          const injectedData = dataArray.map((item) => injectCreateFields(item, wsCtx, fullConfig));\n\n          return query({\n            ...stripSkipFlag(args),\n            data: Array.isArray(args.data) ? injectedData : injectedData[0],\n          });\n        },\n\n        // ================================================================\n        // UPDATE OPERATIONS - inject updatedBy into data + workspaceId into where\n        // ================================================================\n\n        async update({\n          model,\n          args,\n          query,\n        }: ExtensionHandlerParams<{\n          data: Record<string, unknown>;\n          where?: Record<string, unknown>;\n          _skipWorkspaceInjection?: boolean;\n          [key: string]: unknown;\n        }>) {\n          if (fullConfig.excludeModels.includes(model) || args._skipWorkspaceInjection) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'update', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n\n          const injectedData = injectUpdateFields(args.data, wsCtx, fullConfig);\n\n          // Inject workspaceId into where clause for update isolation\n          let injectedWhere = args.where;\n          if (fullConfig.enableUpdateWhereIsolation && !isExcludedFromReadIsolation(model, fullConfig)) {\n            injectedWhere = injectWhereClause(args.where, wsCtx);\n          }\n\n          if (fullConfig.debug) {\n            const injectedDataKeys = Object.keys(injectedData).filter((k) => !(k in args.data));\n            const whereChanged = injectedWhere !== args.where;\n            if (injectedDataKeys.length > 0 || whereChanged) {\n              logger.debug(\n                `[WorkspaceExtension] ${model}.update - injected data: ${injectedDataKeys.join(', ')}${whereChanged ? ', where: workspaceId' : ''}`\n              );\n            }\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            data: injectedData,\n            where: injectedWhere,\n          });\n        },\n\n        async updateMany({\n          model,\n          args,\n          query,\n        }: ExtensionHandlerParams<{\n          data: Record<string, unknown>;\n          where?: Record<string, unknown>;\n          _skipWorkspaceInjection?: boolean;\n          [key: string]: unknown;\n        }>) {\n          if (fullConfig.excludeModels.includes(model) || args._skipWorkspaceInjection) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'updateMany', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n\n          const injectedData = injectUpdateFields(args.data, wsCtx, fullConfig);\n\n          // Inject workspaceId into where clause for update isolation\n          let injectedWhere = args.where;\n          if (fullConfig.enableUpdateWhereIsolation && !isExcludedFromReadIsolation(model, fullConfig)) {\n            injectedWhere = injectWhereClause(args.where, wsCtx);\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            data: injectedData,\n            where: injectedWhere,\n          });\n        },\n\n        async upsert({\n          model,\n          args,\n          query,\n        }: ExtensionHandlerParams<{\n          create: Record<string, unknown>;\n          update: Record<string, unknown>;\n          where?: Record<string, unknown>;\n          _skipWorkspaceInjection?: boolean;\n          [key: string]: unknown;\n        }>) {\n          if (fullConfig.excludeModels.includes(model) || args._skipWorkspaceInjection) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'upsert', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n\n          const injectedCreate = injectCreateFields(args.create, wsCtx, fullConfig);\n          const injectedUpdate = injectUpdateFields(args.update, wsCtx, fullConfig);\n\n          // Inject workspaceId into where clause for upsert isolation\n          let injectedWhere = args.where;\n          if (fullConfig.enableUpdateWhereIsolation && !isExcludedFromReadIsolation(model, fullConfig)) {\n            injectedWhere = injectWhereClause(args.where, wsCtx);\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            create: injectedCreate,\n            update: injectedUpdate,\n            where: injectedWhere,\n          });\n        },\n\n        // ================================================================\n        // READ OPERATIONS - inject workspaceId into where clause\n        // ================================================================\n\n        async findMany({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableReadIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'findMany', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.findMany - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n\n        async findFirst({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableReadIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'findFirst', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.findFirst - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n\n        async findFirstOrThrow({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableReadIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'findFirstOrThrow', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.findFirstOrThrow - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n\n        async findUnique({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableReadIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'findUnique', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n\n          // For findUnique, the where clause uses unique fields.\n          // We inject workspaceId only if the where clause is a plain object\n          // (compound unique keys with workspaceId are common and already include it).\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.findUnique - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n\n        async findUniqueOrThrow({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableReadIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'findUniqueOrThrow', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.findUniqueOrThrow - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n\n        async count({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableReadIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'count', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.count - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n\n        async aggregate({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableReadIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'aggregate', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.aggregate - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n\n        async groupBy({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableReadIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'groupBy', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.groupBy - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n\n        // ================================================================\n        // DELETE OPERATIONS - inject workspaceId into where clause\n        // ================================================================\n\n        async delete({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableDeleteIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'delete', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.delete - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n\n        async deleteMany({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableDeleteIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'deleteMany', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.deleteMany - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n      },\n    },\n  });\n}\n"]}

package/dist/{chunk-IIUYANNF.js → chunk-WHSIZCJX.js}

@@ -229,16 +229,14 @@ var resolveSecurityOptionsFromEnv = /* @__PURE__ */ __name((gatewayName, costMap
       observeOnly: boolEnv("RATE_LIMIT_OBSERVE_ONLY", true),
       failClosed: boolEnv("RATE_LIMIT_FAIL_CLOSED", false),
       perWorkspace: {
-        // Enabled + observe-only by default: measures per-workspace aggregate
-        // load (the audit's missing "noisy-neighbor attribution") with ZERO
-        // behavior change. Flip RATE_LIMIT_WS_OBSERVE_ONLY=false to enforce after
-        // reviewing the tier='workspace' metric + exceed logs. Generous default
-        // budget so enforcement (when enabled) never trips normal usage.
+        // Per-workspace aggregate limiter. observe-only period ended 2026-07-05
+        // (2-day bake verified zero normal-usage trips at 6000 req/min budget).
+        // Override with RATE_LIMIT_WS_OBSERVE_ONLY=true to revert to measure-only.
         enabled: boolEnv("RATE_LIMIT_WS_ENABLED", true),
         points: intEnv("RATE_LIMIT_WS_POINTS", 6e3),
         duration: intEnv("RATE_LIMIT_WS_DURATION", 60),
         burst: intEnv("RATE_LIMIT_WS_BURST", 2e3),
-        observeOnly: boolEnv("RATE_LIMIT_WS_OBSERVE_ONLY", true)
+        observeOnly: boolEnv("RATE_LIMIT_WS_OBSERVE_ONLY", false)
       }
     },
     operationTimeout: {
@@ -1372,5 +1370,5 @@ var buildSecurityPlugins = /* @__PURE__ */ __name(async (options) => {
 }, "buildSecurityPlugins");
 
 export { DEFAULT_ARMOR_CONFIG, DEFAULT_COST_MAP, DEFAULT_TIERS, MemoryValkey, __resetMetricsForTest, __setSecurityValkeyForTest, buildSecurityPlugins, checkRateLimit, createArmorPlugins, createOperationTimeoutPlugin, createOtelPlugin, createQueryComplexityPlugin, createRateLimitPlugin, getMetrics, getSecurityValkey, initializeMetrics, initializeOtel, initializeSecurityValkey, mergeCostMap, resolveActor, resolveSecurityOptionsFromEnv, resolveTiersFromEnv, scrapeMetrics, security_exports, shutdownOtel };
-//# sourceMappingURL=chunk-IIUYANNF.js.map
-//# sourceMappingURL=chunk-IIUYANNF.js.map
+//# sourceMappingURL=chunk-WHSIZCJX.js.map
+//# sourceMappingURL=chunk-WHSIZCJX.js.map